In this paper, we propose a novel adversarial defence mechanism for image classification -- CARSO -- inspired by cues from cognitive neuroscience. The method is synergistically complementary to adversarial training and relies on knowledge of the internal representation of the attacked classifier. Exploiting a generative model for adversarial purification, conditioned on such representation, it samples reconstructions of inputs to be finally classified. Experimental evaluation by a well-established benchmark of varied, strong adaptive attacks, across diverse image datasets and classifier architectures, shows that CARSO is able to defend the classifier significantly better than state-of-the-art adversarial training alone -- with a tolerable clean accuracy toll. Furthermore, the defensive architecture succeeds in effectively shielding itself from unforeseen threats, and end-to-end attacks adapted to fool stochastic defences. Code and pre-trained models are available at https://github.com/emaballarin/CARSO .

翻译：摘要：本文提出了一种受认知神经科学启发的图像分类对抗防御新机制——CARSO。该方法与对抗训练具有协同互补性，并依赖于被攻击分类器内部表示的先验知识。通过利用基于该内部表示条件约束的生成模型进行对抗净化，该方法对输入进行重构采样，最终实现对输入的正确分类。在涵盖多种图像数据集和分类器架构的多样化强自适应攻击基准测试中，实验评估表明：CARSO在容忍可接受的干净样本精度损失前提下，其防御性能显著优于仅采用最先进对抗训练的方法。此外，该防御架构能有效抵御未知威胁，以及针对随机防御机制优化的端到端攻击。相关代码与预训练模型已公开于https://github.com/emaballarin/CARSO。